enigmatic-man/decryption_scripts

DECRYPTION_SCRIPTS is a collection of Python scripts that reverse the proprietary encryption used by the saved configuration files of several Android VPN and proxy tunneling apps, including HTTP Injector, NPV Tunnel, HTTP Custom, Dark Tunnel, and SSC Custom. Each app stores its connection settings, such as servers and credentials, in an encrypted file, and each script figures out that specific app's encryption method so the settings can be read back out as plain, human-readable JSON. Every script follows the same simple pattern: you read a config file into raw bytes and pass it to a run function, and it returns the decrypted contents as a JSON string. Under the hood, each app uses a different chain of encryption steps, some using well-known algorithms like AES and ChaCha20, others adding custom or app-specific obfuscation layers on top. The README documents each app's decryption chain in detail, step by step, for anyone wanting to understand how it works. Setting it up only requires Python and a small number of packages installed through pip, since most of the underlying support code is part of Python's standard library. There is no server or account needed, everything runs locally on a config file you already have. The project explicitly states it is meant for educational purposes and for recovering your own legitimate configuration files, and asks users to respect the terms of service of these apps and the privacy of others. This project is aimed at developers and researchers interested in reverse engineering and cryptography, not at general end users of these VPN apps.